India DPDP Act 2023 and DPDP Rules 2025, Phase 1 duties, version 1

Every time you ask someone for consent, show them a notice first or at the same moment. It must make sense on its own and say in plain words: each item of personal data you want, why you want it and what service it is for, and a link to your website or app, plus how they can withdraw consent, use their rights and complain to the Data Protection Board. Let them read it in English or any of the 22 languages in the Eighth Schedule of the Constitution.

s.5(1), s.5(3), Rule 3 · In force from 12 May 2027 · Standing · in.dpdp/notice.before_consent

For people who gave you consent before the notice rules began, send a notice as soon as you reasonably can after 13 May 2027, by email, an in-app message or another way that reaches them. Say which personal data you have used and for what, how they can withdraw consent, how to complain to you, and how to complain to the Data Protection Board. You may keep using their data unless they withdraw.

s.5(2), s.5(3), Rule 3 · In force from 12 May 2027 · Standing · in.dpdp/notice.legacy

Ask for consent with a clear action, such as a box the person ticks themselves, separately for each purpose, and only for the data that purpose needs. Do not bundle it into your terms. Put your contact person's details in the request. Let people withdraw as easily as they agreed, for example with one tap in the same place. After a withdrawal, stop using their data, and make your vendors stop, within a reasonable time, unless a law requires you to continue.

s.6(1), s.6(2), s.6(3), s.6(4), s.6(6), Rule 3 · In force from 12 May 2027 · Standing · in.dpdp/consent.valid_and_withdrawable

Keep a record you can show later for each consent: who agreed, which notice version and language they saw, which data and purposes they agreed to, and when and how (website, counter, WhatsApp). Keep every version of your notice with its date. Record withdrawals the same way.

s.6(10) · In force from 12 May 2027 · Standing · in.dpdp/consent.proof

If you accept customer permissions through a Consent Manager, check that the Data Protection Board has registered it before you rely on it, and note when you checked. The Board publishes the details of each Consent Manager it registers on its website. Check again if the Board suspends or cancels a registration.

s.6(9), Rule 4 · In force from 12 Nov 2026 · Standing · in.dpdp/consent.manager_registered

Where you use someone's data to make a decision about them, or pass it to another business, make sure it is complete, accurate and consistent. Check it before you use or share it, and fix errors when you find them or are told about them.

s.8(3) · In force from 12 May 2027 · Standing · in.dpdp/accuracy.decisions_and_sharing

When a person who gave you their data asks what you hold, give them a summary of their personal data and what you do with it, and the names of every other business and vendor you shared it with and what you shared. Reply within 90 days of receiving the request and put your contact person in the reply.

s.11, Rule 9, Rule 14(3), PIB 17 Nov 2025 · In force from 12 May 2027 · Per request access, from receipt · 90 days · in.dpdp/rights.access

When a person asks you to correct wrong or misleading data, fill in missing data or bring it up to date, do it and tell them it is done. Reply within 90 days of receiving the request and put your contact person in the reply.

s.12(2), Rule 9, Rule 14(3), PIB 17 Nov 2025 · In force from 12 May 2027 · Per request correction, from receipt · 90 days · in.dpdp/rights.correction

When a person asks you to erase their personal data, erase it and make your vendors erase what you gave them, unless you still need it for the purpose they agreed to or a law makes you keep it. Reply within 90 days of receiving the request and put your contact person in the reply.

s.12(3), s.8(7), Rule 9, Rule 14(3), PIB 17 Nov 2025 · In force from 12 May 2027 · Per request erasure, from receipt · 90 days · in.dpdp/rights.erasure

Let a person name one or more people who can use their data rights if they die or can no longer act because of illness of mind or body. Record the nominee in the way your terms of service set out, and confirm it to the person with your contact person in the reply.

s.14, Rule 14(4), Rule 9 · In force from 12 May 2027 · Per request nomination, from receipt · in.dpdp/rights.nomination

Give people an easy way to complain about how you handle their personal data, for example a form, an email address or a phone number. Publish on your website or app how long you take to answer: a reasonable period of no more than 90 days. Name someone to answer and make sure they can meet that time.

s.8(10), s.13, Rule 14(3) · In force from 12 May 2027 · Standing · in.dpdp/grievance.mechanism

Answer each complaint within the period you published, and never later than 90 days after you received it. Put your contact person in the reply. Fohrkast counts the 90-day limit; if you published a shorter period, work to that.

s.13, Rule 14(3), Rule 9 · In force from 12 May 2027 · Per grievance, from receipt · 90 days · in.dpdp/grievance.respond

As soon as you know personal data was breached, tell each affected person without delay, through their account with you or the phone number or email they registered. In short, plain words say: what happened, when and how much; what it may mean for them; what you are doing about it; what they can do to protect themselves; and who at your business they can contact.

s.8(6), Rule 7(1) · In force from 12 May 2027 · Per incident, from awareness · Without delay · in.dpdp/breach.tell_people

Without delay after you know of a personal data breach, send the Data Protection Board a first description: what happened, how much data, when and where it happened, and the likely impact.

s.8(6), Rule 7(2)(a) · In force from 12 May 2027 · Per incident, from awareness · Without delay · in.dpdp/breach.tell_board

Within 72 hours of becoming aware of the breach, send the Board the detailed report: updated details of what happened; the facts, circumstances and reasons behind it; what you have done or plan to do to reduce the risk; any findings about who caused it; the steps to stop it happening again; and a report on the notices you sent to affected people. The Board may allow longer if you ask in writing.

s.8(6), Rule 7(2)(b) · In force from 12 May 2027 · Per incident, from awareness · 72 hours · in.dpdp/breach.board_report

Before you use any personal data of a child (anyone under 18), get consent from the child's parent and check that the parent is an identifiable adult: against reliable identity and age details you already hold, or details the parent gives you, or a token from an authorised provider such as a Digital Locker service. A few uses are exempt, for example a clinic giving health care to the child (Fourth Schedule); rely on an exemption only for that use.

s.9(1), Rule 10, Rule 12, Fourth Schedule · In force from 12 May 2027 · Standing · in.dpdp/children.parent_consent

Never use a child's data in a way likely to harm their well-being. Do not track children, monitor their behaviour or show them targeted ads, so switch off ad and tracking tools for child users. A school, creche or school transport may track only as the Fourth Schedule allows, for example a child's location during travel for safety.

s.9(2), s.9(3), Rule 12, Fourth Schedule · In force from 12 May 2027 · Standing · in.dpdp/children.no_tracking

When an adult with a disability acts through a lawful guardian, get the guardian's consent before using the person's data, and check that the guardian was appointed by a court, by a designated authority under the Rights of Persons with Disabilities Act 2016, or by a local level committee under the National Trust Act 1999.

s.9(1), S.O. 5458(E), Rule 11 · In force from 12 May 2027 · Standing · in.dpdp/children.guardian_disability

Protect the personal data you hold, including what your vendors hold for you. At the minimum: encrypt, mask or tokenise it; control who can open the computers, phones and apps that hold it; keep logs of who accessed it and review them; keep backups so you can carry on after a loss; keep those logs and the data for one year to investigate problems, unless another law says otherwise; and check that these measures keep working.

s.8(5), Rule 6(1), Rule 6(1)(e) · In force from 12 May 2027 · Standing · in.dpdp/security.safeguards

Before any outside company handles personal data for you, have a valid contract with it that includes reasonable security safeguards. Keep a list of these vendors and their contracts. You stay responsible for what they do with the data, whatever the contract says.

s.8(1), s.8(2), Rule 6(1)(f) · In force from 12 May 2027 · Standing · in.dpdp/processors.contract

When a person withdraws consent, or once it is reasonable to assume the purpose is over (for example the order is delivered and paid for and nothing more is needed), erase their personal data and make your vendors erase what you gave them. Keep only what a law requires you to keep, such as the one-year copy under Rule 8(3).

s.8(7) · In force from 12 May 2027 · Standing · in.dpdp/erasure.purpose_over

If a user has not used your service for its purpose, contacted you or used a data right for 3 years, erase their personal data, except what lets them reach their account or any stored value they can spend. At least 48 hours before, tell them their data will be erased unless they log in, contact you or use a right.

s.8(8), Rule 8(1), Rule 8(2), Third Schedule · In force from 12 May 2027 · Standing · in.dpdp/retention.third_schedule

For every use of personal data, by you or by a vendor for you, keep the data, its traffic data and the logs of that processing for at least one year from the date of the processing, even if the customer closes their account. Keep this copy only for the purposes in the Seventh Schedule (lawful calls by the government). Then erase it, unless another law needs it kept longer.

Rule 8(3), Seventh Schedule · In force from 12 May 2027 · Standing · in.dpdp/retention.one_year

Show clearly on your website or app the business contact (email or phone) of your Data Protection Officer, or of a person who can answer questions about how you use personal data. Repeat that contact in every reply to a rights request. Also publish how people can make a request and which details you need to find them, such as a customer ID, mobile number or email.

s.8(9), Rule 9, Rule 14(1) · In force from 12 May 2027 · Standing · in.dpdp/contact.publish

Only if the government has named you a Significant Data Fiduciary. Appoint a Data Protection Officer based in India who answers to your board of directors and is the contact for complaints. Appoint an independent data auditor. Once in every 12 months from the date you were named, carry out a Data Protection Impact Assessment and an audit, and have whoever did them send the Board a report of the main findings. Check that your software and algorithms are not likely to put people's rights at risk.

s.10(2), S.O. 5458(E), Rule 13 · In force from 12 May 2027 · Standing · in.dpdp/sdf.duties

If an authorised government officer asks you for information for a purpose listed in the Seventh Schedule, provide it within the period stated in the request. If the request says not to tell anyone, including the person the data is about, do not tell them unless the officer allows it in writing.

s.36, Rule 23, Seventh Schedule · In force from 12 May 2027 · Per gov call, from receipt · in.dpdp/government.information

If the Data Protection Board sends you a direction, do what it says within any time it sets, and keep proof that you did. If you disagree, you can ask the Board to change it, or appeal to the Appellate Tribunal (TDSAT) within 60 days of receiving it.

s.27(2), s.29(2) · In force from 12 May 2027 · Per board order, from receipt · in.dpdp/government.board_direction